Overview
overview
10Static
static
10-pril-main...th.exe
windows7-x64
10-pril-main...th.exe
windows10-2004-x64
10-pril-main...aw.exe
windows7-x64
10-pril-main...aw.exe
windows10-2004-x64
10-pril-main...wd.exe
windows7-x64
7-pril-main...wd.exe
windows10-2004-x64
7-pril-main...gh.exe
windows7-x64
10-pril-main...gh.exe
windows10-2004-x64
10-pril-main...se.exe
windows7-x64
10-pril-main...se.exe
windows10-2004-x64
10-pril-main...ed.exe
windows7-x64
10-pril-main...ed.exe
windows10-2004-x64
10Installer/Accord.dll
windows7-x64
1Installer/Accord.dll
windows10-2004-x64
1Installer/CapCut.exe
windows7-x64
8Installer/CapCut.exe
windows10-2004-x64
10Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 08:13
Static task
static1
Behavioral task
behavioral1
Sample
-pril-main/dwthjadth.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
-pril-main/dwthjadth.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
-pril-main/feuiyjjdaw.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
-pril-main/feuiyjjdaw.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
-pril-main/kldrgawdtjawd.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
-pril-main/kldrgawdtjawd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
-pril-main/pothjadwtrgh.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
-pril-main/pothjadwtrgh.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
-pril-main/ptjjsekfthse.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
-pril-main/ptjjsekfthse.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
-pril-main/thadkythjawed.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
-pril-main/thadkythjawed.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Installer/Accord.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Installer/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Installer/CapCut.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Installer/CapCut.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity full v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity full v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity micro v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity micro v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity subset v3.5/Accord.dll
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity subset v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity web v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity web v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Installer/Tools/Accord.3.8.0/lib/net35/Accord.dll
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
Installer/Tools/Accord.3.8.0/lib/net35/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Installer/Tools/Accord.3.8.0/lib/net40/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Installer/Tools/Accord.3.8.0/lib/net40/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Installer/Tools/Accord.3.8.0/lib/net45/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Installer/Tools/Accord.3.8.0/lib/net45/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Installer/Tools/Accord.3.8.0/lib/net46/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Installer/Tools/Accord.3.8.0/lib/net46/Accord.dll
Resource
win10v2004-20241007-en
General
-
Target
-pril-main/ptjjsekfthse.exe
-
Size
631KB
-
MD5
4d95ea8721d0a84b69c2d60951a8a65e
-
SHA1
b3b9230b284c32e8d35c65b6b31d0a1b729c6d7c
-
SHA256
1aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d
-
SHA512
7500b73aa452a6452fd6fe41df0fbffa96821918df34fcff2a29bf2072f5fdb02886fa0945f5d567fefcf30de6d042b4e17e6760bb5e5a3ceba11767316c3fee
-
SSDEEP
12288:Cr2N7ewZcHjHkoP19jpVgUbdxGU2NjCa8UQGqIJ7uHXNI8W2Zx:Cr2EEypVg4x8NmtjS+
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ptjjsekfthse.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:/Users/Admin/AppData/Local/\\ptjjsekfthse.exe\"" ptjjsekfthse.exe -
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4036 3080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3404 3080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4892 3080 schtasks.exe -
Processes:
resource yara_rule behavioral10/memory/2796-1-0x0000000000940000-0x00000000009E4000-memory.dmp dcrat C:\Users\Admin\AppData\Local\ptjjsekfthse.exe dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ptjjsekfthse.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ptjjsekfthse.exe -
Executes dropped EXE 1 IoCs
Processes:
ptjjsekfthse.exepid process 4688 ptjjsekfthse.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ptjjsekfthse.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ptjjsekfthse = "\"C:/Users/Admin/AppData/Local/\\ptjjsekfthse.exe\"" ptjjsekfthse.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ptjjsekfthse = "\"C:/Users/Admin/AppData/Local/\\ptjjsekfthse.exe\"" ptjjsekfthse.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
ptjjsekfthse.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings ptjjsekfthse.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 3404 schtasks.exe 4892 schtasks.exe 4036 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
ptjjsekfthse.exeptjjsekfthse.exepid process 2796 ptjjsekfthse.exe 4688 ptjjsekfthse.exe 4688 ptjjsekfthse.exe 4688 ptjjsekfthse.exe 4688 ptjjsekfthse.exe 4688 ptjjsekfthse.exe 4688 ptjjsekfthse.exe 4688 ptjjsekfthse.exe 4688 ptjjsekfthse.exe 4688 ptjjsekfthse.exe 4688 ptjjsekfthse.exe 4688 ptjjsekfthse.exe 4688 ptjjsekfthse.exe 4688 ptjjsekfthse.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ptjjsekfthse.exepid process 4688 ptjjsekfthse.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ptjjsekfthse.exeptjjsekfthse.exedescription pid process Token: SeDebugPrivilege 2796 ptjjsekfthse.exe Token: SeDebugPrivilege 4688 ptjjsekfthse.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ptjjsekfthse.execmd.exedescription pid process target process PID 2796 wrote to memory of 4896 2796 ptjjsekfthse.exe cmd.exe PID 2796 wrote to memory of 4896 2796 ptjjsekfthse.exe cmd.exe PID 4896 wrote to memory of 3132 4896 cmd.exe w32tm.exe PID 4896 wrote to memory of 3132 4896 cmd.exe w32tm.exe PID 4896 wrote to memory of 4688 4896 cmd.exe ptjjsekfthse.exe PID 4896 wrote to memory of 4688 4896 cmd.exe ptjjsekfthse.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\-pril-main\ptjjsekfthse.exe"C:\Users\Admin\AppData\Local\Temp\-pril-main\ptjjsekfthse.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6xPpo26MbF.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:3132
-
C:\Users\Admin\AppData\Local\ptjjsekfthse.exe"C:/Users/Admin/AppData/Local/\ptjjsekfthse.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ptjjsekfthsep" /sc MINUTE /mo 11 /tr "'C:/Users/Admin/AppData/Local/\ptjjsekfthse.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ptjjsekfthse" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\ptjjsekfthse.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ptjjsekfthsep" /sc MINUTE /mo 7 /tr "'C:/Users/Admin/AppData/Local/\ptjjsekfthse.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57800fca2323a4130444c572374a030f4
SHA140c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa
SHA25629f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
SHA512c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554
-
Filesize
211B
MD55ba54ae4bf6ca0d1874fad695a13622b
SHA12aa44253c2f0d3891d0d076c080feb37b38c1a64
SHA25697a298f2639c89c176cb408845367f1f69a5d45b038b028c204214c81c7e4c0b
SHA512be0c526fe9160619498e63c66d644a2934dea003d0a2ee1715d5be9a04b38de76be2a46a77339c0de5e204d346f77b1bef02ac4fa1f7f2dbfcc4b2c7a12f5756
-
Filesize
631KB
MD54d95ea8721d0a84b69c2d60951a8a65e
SHA1b3b9230b284c32e8d35c65b6b31d0a1b729c6d7c
SHA2561aeaabc57a89dd8508a5e997236b91b3cd7e584dad94700fcad9d8637d2b926d
SHA5127500b73aa452a6452fd6fe41df0fbffa96821918df34fcff2a29bf2072f5fdb02886fa0945f5d567fefcf30de6d042b4e17e6760bb5e5a3ceba11767316c3fee